Built-in Azure role for viewing incidents, workbooks and data in Sentinel; it can't change incidents.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Microsoft Sentinel Reader in context, with comparison tables and the common traps.
Terms in this definition
- Role
How an actor normally or expectedly behaves, or the part a person takes in a process. A single actor may hold more than one role.
- Azure Monitor workbooks
Reports in Azure that you can interact with, mixing KQL queries, metrics, parameters and text. Send Intune logs to Log Analytics and you can build them on that data.
Related terms
- On-behalf-of authentication
Security Copilot relies on this OAuth flow so that a plugin never exceeds what the signed-in user may see. As a result, users need data roles too, Microsoft Sentinel Reader for example.